Intelligence beyond indicators.
Cloakline reveals the hidden lines connecting indicators, infrastructure, campaigns, and adversary activity. Most threat-intelligence platforms stop at the indicator. We connect the lines behind it.
Why Cloakline
Indicators are everywhere and nearly free — MISP, OpenCTI, abuse.ch, OTX and others give them away by the million. That commoditization is exactly the problem: a raw blocklist with no provenance, no score, and no context isn't intelligence. It's a liability waiting to take down a legitimate CDN or cloud range.
The value a SOC will actually pay for is the work after the indicator: corroborating it, scoring it defensibly, and correlating it into the infrastructure and campaigns behind it — done faster and more trustworthily than the team could alone. That correlation quality and analyst workflow is what Cloakline is built around.
How we're built
Cloakline is designed as a fabric of focused AI agents — collection, enrichment, correlation, and scoring — coordinated into one pipeline. Each agent does a narrow job well and hands typed, evidenced output to the next, so the system stays observable and every result traces back to its inputs.
We deliberately do the hard, boring parts first: an honest source-and-licensing model, a clean STIX 2.1 + MISP-aligned data model that separates the canonical indicator from each source's sighting, deterministic correlation rules before any machine learning, and explainable scoring before sophistication.
What we build on.
Explainability over sophistication
Every score and edge is defensible to a SOC analyst — inputs, weights, and evidence on screen. No black box.
Propose, don't publish
We recommend; we never auto-block and never auto-attribute a named actor. A human stays in the loop.
Honest about sources
Every feed is classified by license — what we can redistribute, derive from, or not use at all. We don't resell what isn't ours.
Trustworthy by construction
We hold adversary data and customer context, so tenant isolation, data minimization, and least privilege are designed in.
Built for defenders.
Cloakline is built for the teams that live in adversary data every day.
Private beta, with design partners.
Cloakline is early and deliberately so — we're proving correlation quality and explainable scoring with a small set of design-partner SOCs before we open it up.